Evidence across delivery settings for cyber resilience

The control, interpretation should begin with the intended outcome, then identify the controls and evidence needed to show that the outcome is achieved across the declared scope.

For cyber resilience, the intended substantive result should remain the starting point for review. The control, education information should be collected for a defined purpose, protected in proportion to its sensitivity and retained only for an authorised period.

Scope and application of evidence across delivery settings for cyber resilience

Relevant evidence for cyber resilience will normally include incident response and notification records, role-based access and access reviews, retention and secure disposal evidence, data-quality and correction controls, and lawful authority and consent records where relevant. Evidence outside the relevant period or scope should be identified and given no more weight than its limitations permit.

Assurance concerning the conclusion should state the scope examined, evidence relied upon and any condition preventing a complete conclusion. Unsupported elements should remain open. For cyber resilience, decision-makers should state which matters are evidenced, which express policy and which require authorised judgement.

Review of the control should follow a stated and reproducible method. Across the defined scope, the subject should be examined as a connected system of policy, people, resources, decisions and evidence. For cyber resilience, the method, assumptions and limitations should be stated in terms suitable for responsible decision-making.

A narrow control over the applicable requirement may create false assurance. In the present context, retention beyond an identified need, uncontrolled supplier access or transfer and inaccurate data affecting decisions may produce acceptable aggregate reporting while individual learners remain exposed to material disadvantage.

Controls for evidence across delivery settings for cyber resilience

Implementation of cyber resilience should be organised around a decision that can be tested. For the control, conformity should not be inferred from a policy document alone; operating records and outcomes should show that the stated arrangements are in use.

The control, governing bodies should receive a concise account of the intended result, affected scope, principal risks, evidence limitations and unresolved exceptions. In the context of cyber resilience, the action record should identify who is responsible and when implementation is due.

For decisions concerning cyber resilience, records relating to the control should preserve both the conclusion and its limits.

• Provide accessible correction and complaint routes.
• Assign accountable data owners before it is relied on for a decision with material effect.
• Verify accuracy where information affects learners.
• Control third-party processing.
• Test incident and recovery arrangements.

Review of evidence across delivery settings for cyber resilience

Implementation of cyber resilience can be tested without imposing unnecessary reporting. A competent review of the conclusion should map the complete process, identify the intended result and responsible authority at each stage, and test normal cases together with exceptions.

Interpretation of cyber resilience should produce a test that another competent reviewer can apply to comparable evidence.

Any conclusion on the matter should remain within the scope supported by the evidence. In the context of cyber resilience, security, privacy and data quality are related but distinct.

The decision record for cyber resilience should connect the stated objective to suitable evidence and the position of those affected. Where evidence concerning cyber resilience cannot support assurance, the limitation should be reported and corrective work should remain open.